Locally synced open issues (discussions stay on GitHub)
F2: depositToWinternitz has no caller binding, anyone can create your vault with their own PQ key (v0)
F1: one Winternitz signature authorises two different QuipWallet operations (v0)